Cloudflare Tunneling
| Author Info | |
|---|---|
| Author | mjlo |
| Discord | mjlo |
This is a quick guide on how to set up a secure cloudflare tunnel to a resource behind a firewall, and then host that resource on securely on the public internet, with optional zero trust login. This is all free for basic usage.
- note I am not actually following these steps, but trying to walk through them after the fact. things will probably be off a little.
What you need
- Cloudflare Account (sign up at dash.cloudflare.com)
- a Domain (doesn't have to be transferred to cloudflare)
- a webserver (doesn't have to be secure or accessible on the internet)
Steps
- you don't need to transfer the domain, but you do have to host your DNS at cloudflare (free). I think if you transfer your domain, yearly renewal is about $10 USD per domain. Not sure if that's a good price or not. it might be cheaper than my current host, but not by much.
- gather up all of your dns entries before switching unless your current DNS provider loses them when you switch.
- add a domain - Domains -> Overview -> Add domain
- when domain DNS is complete, go to Networking -> Tunnels -> Create Tunnel
- it'll give you download links/commands to install cloudflared on your computer and connect cloudflared to your account.
- when you have a tunnel set up, open the tunnel and Add Route -> Published Application
- subdomain is the domain url, ie: nuthatch.jadetimber.com
- path is optional, if you want to redirect different folders to different servers. (ie nuthatch.jadetimber.com/test1 -> server1 / nuthatch.jadetimber.com/test2 -> server2
- if no path is specified, it applies to the full domain
- service URL is the url and port as the machine running cloudflared sees it. the webserver is listening on (ie. http://localhost:8080
- can be http, as it's passing through an encrypted tunnel to a cloudflare server.
- cloudflare will add a letsencrypt cert automatically and redirect all incoming public http traffic to https (ie http://nuthatch.jadetimber.com/meme.jpg will auto-forward to https://nuthatch.jadetimber.com/meme.jpg, which would read from http://localhost:8080/meme.jpg on your local webserver)
- if you want only you/specific people you trust to access this webpage click "Zero Trust"
- Access Controls -> Policies -> Add a policy
- add a rule to Include -> Emails -> enter the email address(es) you want to have access to this domain
- Action: Allow
- Policy Session Duration: when you log in, how long until that login expires (browser cookie specific, opening a different browser or an incognito window will ask again)
- there may be other ways to do this, this is just what I have set up for myself.
- Access Controls (still in Zero Trust) -> Applications -> Create new application (if it doesn't already exist)
- add subdomain and path you set up earlier
- Access Policies -> Add existing policy -> policy you created earlier
- Access Controls -> Policies -> Add a policy
That should hopefully be all you need. If this needs updating/corrections, ping mjlo on discord, or edit it? idk wikis.